Synopsis Following maintenance activity involving the right off-wing slide system, the aircraft had a slide door alert message illuminate while being de-iced. The aircraft was released for the flight under the authority of the minimum equipment list. During the approach to the Vancouver International Airport, the right off-wing slide compartment door opened, and the right off-wing slide separated from the aircraft. The aircraft landed without further incident. The Board determined that the right off-wing slide compartment door opened in flight because the secondary lock shear-pin had been inadvertently sheared during recent inspection; this maintenance error remained undetected because existing required inspection procedures had not been followed. Contributing to the deviations from formal standard practices was inadequate understanding of the system on the part of the maintenance technicians and supervisor. 1.0 Factual Information 1.1 History of the Flight C-GAUH, a Boeing 767-233 aircraft, was undergoing a scheduled maintenance A check at Toronto during the night shift. The check was near completion when the right off-wing slide deployment system was inadvertently initiated, which fired the spoiler override actuator, the latch opening actuator, and the door opening actuators; a job ticket was raised to replace these actuators. The aircraft was ready for service at 0930 eastern daylight saving time (EDT) 1 and the aircraft arrived at the gate at 1020 for a planned push-back at 1045 as flight 899. Flight 899 completed loading, pushed back from the gate at 1116, and taxied to the designated de-ice area where the aircraft was de-iced. There were 2 pilots, 6 cabin crew, and 95 passengers on board. During the taxi following de-icing, the overhead EMERGENCY DOOR warning illuminated, and the engine indication and crew alerting system (EICAS) displayed a R WING SLIDE message. The flight crew consulted the minimum equipment list (MEL), and found that they were required to return-to-gate. They taxied back to the ramp and advised Air Canada ramp maintenance by radio; maintenance dispatched a certified aircraft technician to investigate the problem. The ramp technician examined the door, which appeared faired and closed, and visually inspected the integrator to confirm that the door was latched and closed. During this examination, the door alert message went out, and the technician verbally released the aircraft. The aircraft was de-iced a second time and, during de-icing, the right slide door alert message activated again and stayed on. Ramp maintenance was again advised of the situation; they did not investigate further but informed the flight crew that there was no actual problem with the door, and that the door indication system was faulty. They released the aircraft verbally with the steady door alert under the provisions of the MEL. The aircraft had been delayed a total of one hour and fifteen minutes when it finally departed at noon from Toronto/Lester B. Pearson International Airport, Ontario, on a scheduled domestic flight to Vancouver, British Columbia. The right slide door warning light and the EICAS message stayed on for the duration of the flight. On the downwind leg for runway 08 at Vancouver, one of the flight attendants reported to the captain that a loud bang had been heard in the passenger cabin. The crew checked their instrumentation for any abnormality, and noted that the aircraft was performing normally. They suspected that cargo may have shifted and they radioed this information ahead for the ground crew. They landed and taxied to the gate at the terminal. After shutdown, the ground crew reported finding the right off-wing slide compartment door open, and the off-wing slide missing. The occurrence took place at latitude 4915'N, longitude 12325'W, during the hours of daylight, at 1359 Pacific daylight saving time (PDT). 1.2 Injuries to Persons 1.3 Damage to Aircraft The aircraft sustained only minor damage as the unfurled slide abraded the paint on the side of the fuselage before it separated. 1.4 Other Damage The missing slide was not recovered, and is believed to have fallen into Georgia Straight and sunk. There have been no reports of other damage caused by the falling slide. 1.5 Personnel Information The flight crew was certified and qualified for the flight in accordance with existing regulations. 1.6 Aircraft Information 1.7 Meteorological Information Weather at Vancouver at the time of the occurrence was as follows: scattered cloud layers at 1,800 and 2,200 feet, broken ceiling at 3,500 feet, visibility 15 miles in light rain, and the wind from 060 at 9 knots. 1.8 Off-wing Slide System 1.8.1 System Overview The Boeing 767 incorporates an inflatable slide at the inboard rear of each wing to allow the evacuation of passengers who use the over-wing exits during an emergency. Slide deployment is initiated by opening the exit hatch from the inside. The hatch opening motion actuates electrical switches that simultaneously (1) operate a relay to ground out any position command going to the main hydraulic spoiler power controller actuator, and (2) fire the spoiler override actuator which rotates the inboard spoiler to the down position. After a two-second time delay (from the spoiler actuator firing), the latch opening actuator is fired. The latch opening actuator opens the escape slide compartment door latches and fires the door opening actuators located in the escape slide compartment. The slide compartment door, with the escape slide packboard assembly attached, is rotated outboard by the actuators. When the door opens, a mechanical link to a high pressure inflation cylinder triggers the release of gas that inflates the slide. Proximity sensors monitor the position of the door latches, and are used to trigger warning lights and EICAS messages on the flight deck. During maintenance such as A checks, the off-wing slide system is de-activated and a safety pin is inserted in the high pressure inflation cylinder to prevent inadvertent deployment and inflation which could cause injury to personnel and damage to equipment. 1.8.2 Design and History of the Integrator The integrator was originally designed and manufactured without a secondary lock. After many incidents in the early 1980s of the off-wing slide compartment door opening in flight, the integrator was re-designed. A secondary lock mechanism was included on new integrators to prevent vibrations from causing the latch shaft to migrate to the unlatched position. Existing integrators were also modified to incorporate this feature. A key characteristic of the secondary lock is the shear pin which holds the secondary lock lever in place during normal operation, but easily shears to allow the actuator to release the door latches. The shear pin is designed to shear at a pre-determined force, and thus allow the opening of the door latches, and in turn, the door. The design of the off-wing slide system is such that the actuator cannot be fired without shearing the secondary lock shear pin. Because of an ongoing number of incidents in the industry, even after the first rework of the secondary lock mechanism, the off-wing slide integrator was redesigned to simplify deactivation procedures. This elective rework was not incorporated on this aircraft. 1.8.3 Inspection after the Landing in Vancouver Inspection of the aircraft after it had landed in Vancouver revealed that the slide inflation trigger was disconnected and the high pressure inflation cylinder was full; the door opening actuators and the latch opening actuator had not fired and the latch pins were in good condition; the sensors and the door warning system functioned normally; and the integrator was found unlatched but in good condition, except for the secondary lock shear pin which had sheared in three pieces but remained in place. A visual inspection of the secondary lock would not reveal that the pin was sheared. 1.9 Restoration of the Off-wing Slide System 1.9.1 Job Ticket Following the inadvertent deployment of the off-wing slide compartment door actuator during the return to normal after the A check, a 12-page job ticket, entitled Off-Wing Escape System - Restoration - 6-225, was generated which listed 31 sign-off items. Not all of the 31 items had to be actioned, because the safety pin that was inserted in the inflation mechanism for the A check prevented the slide from inflating when the off-wing slide compartment door opened. However, replacement of most items was required to restore the system, including replacement of the latch opening actuator, off-wing slide compartment door actuators, and the spoiler blow-down squib. 1.9.2 Disconnection of the Inflation Trigger The night-shift certified aircraft technician who organized the restoration of the system disconnected the mechanical linkage from the off-wing slide compartment door to the trigger on the inflation cylinder both for safety reasons and to allow the slide to lie back down to facilitate maintenance. Disconnection of the inflation trigger was not an item on the job ticket; the job ticket assumes that the inflation cylinder has emptied as a result of the slide having been purposely deployed and inflated during operation of the aircraft rather than inadvertently deployed when the inflation cylinder was safetied with a pin during maintenance. The work required to restore the system extended into the morning shift. The night-shift technician who had disconnected the inflation trigger verbally briefed one of the morning-shift certified aircraft technicians about the disconnection; however, the night-shift technician did not raise a snag or make a written record of it or attach a warning flag. The morning shift technician who had been briefed about the disconnection was subsequently assigned to work on a different aircraft, and the inflation trigger was not reconnected before the aircraft was released for service. 1.9.3 Replacement of the Secondary Lock Shear Pin In addition to the replacement of the fired actuators, the job ticket also required the replacement of the secondary lock shear pin (item 18). The morning-shift certified aircraft technician who readied the aircraft for service signed item 18, which called for the replacement of the secondary lock shear pin, as being completed, but the shear pin was not replaced. The technician reported that there was no replacement shear pin available on the shear pin ring, as stated on the job ticket. Although the pin was sheared into three pieces, the pieces stayed in place in the secondary lock. Thus, it was not readily apparent upon visual inspection that the pin was sheared. Instead of acquiring a new shear pin from the stores department, or from the left off-wing slide integrator, the technician conducted an external visual inspection of the shear pin, and concluded that it did not need to be replaced. Previous shearing of the secondary lock mechanism shear pin and migration of the primary lock permitted the door latch train to migrate from vibration, thus allowing the door to unlatch and open under flight aerodynamic and inertial side loads. 1.10 Minimum Equipment List 1.10.1 Minimum Equipment List Inspection The 767 MEL manual states that the R WING SLIDE message, which first appeared on the EICAS during taxi after the aircraft was de-iced the first time, indicates that the right off-wing slide compartment door is unlatched, and that it must be checked by maintenance personnel to confirm that it is closed and latched. The MEL procedure requires the completion of twelve steps before the aircraft is released as serviceable for each flight until the snag is rectified. These steps include a detailed inspection of the integrator and associated linkage, the actuation of the integrator to unlatch and properly re-latch the off-wing slide compartment door, the placarding of the cockpit warning light, and the placement of an entry in the journey log-book. With the exception of opening the integrator access door to visually inspect the integrator, none of the required maintenance actions took place. Although the ramp maintenance supervisor had access to the requirements of the MEL, the certified aircraft technician conducting the inspection on the ramp was not given the MEL to work from. Furthermore, he did not have ready access to the MEL carried on board the aircraft. The inspecting technician and the ramp maintenance supervisor agreed that there was no need to delay the plane any further and carry out the MEL inspection. They informed the crew that they had determined that the off-wing compartment door was locked and that the steady warning light was an erroneous indication problem; however, there was no discussion between the flight crew and maintenance as to how this determination was made. The ramp maintenance supervisor and the technician were aware of the inadvertent off-wing slide compartment door actuation during the A check, and the subsequent maintenance activity that had just taken place to restore the system. However, the maintenance personnel were generally apprehensive about handling anything associated with the slides for fear of an inadvertent deployment, which can result in personal injury and equipment damage, or delays in aircraft operations. 1.10.2 Flight Crew Acceptance of the Aircraft When the fault warning illuminated and the EICAS message appeared, the flight crew followed standard procedure by consulting the MEL. They returned to the ramp to have the door inspection carried out by maintenance. Although they had no knowledge that the MEL inspection requirements were not carried out by maintenance, they did know that the requirement to placard the warning light and make a log-book entry was not met. They accepted the aircraft as airworthy based on a verbal release from maintenance. 1.11 Qualifications and Training of Maintenance Personnel 1.11.1 Certified Aircraft Technician who Replaced the Actuator The morning-shift certified aircraft technician who completed the A check and readied the aircraft for service was an Air Canada employee who was licensed and endorsed on the Boeing 767-233. He received his initial training on the aircraft in 1991, and since then his only training relative to the B767 was a Difference course on the 767-300 model. He had never previously worked on his own on the off-wing slide system and had worked on the system under supervision on only one occasion, which had been more than two years previously. 1.11.2 Certified Aircraft Technician who Inspected the Aircraft on the Ramp The certified aircraft technician who inspected the aircraft on the ramp was an Air Canada employee who was licensed and endorsed on the Boeing 767-233. He received his initial training on the B767 in early 1990, and had not received any recurrent training since then. In addition, although not endorsed, he had worked on Boeing 747, Lockheed L1011, and McDonnell Douglas DC-9. He had not seen an integrator in about four years; however, he had worked on the off-wing slide system a few times many years ago. 1.11.3 Ramp Maintenance Supervisor The ramp maintenance supervisor was a certified aircraft technician employed by Air Canada. He was filling the position of acting mobile foreman the morning of the incident, when he was called in to carry out the duties of the ramp maintenance supervisor. He had only taken the position for a few minutes when the flight 899 snag arose. Although endorsed for the Boeing 767, he did not have much experience with the aircraft or the off-wing slide system. He was not aware of what was required to release the aircraft in accordance with the MEL.